Understand audit log data

Audit log offers a record of important events in your Greenhouse Recruiting environment from the previous 30 days. You can access audit log with Business Intelligence Connector or Greenhouse API.

Audit log payload

Audit log results contain the following attributes in API and columns in Business Intelligence Connector:

How to use audit log successfully

Audit log returns a rolling record of data changes and updates. Major events are defined in the audit log glossary. To dig further into an event, query by its request_id to find related changes in audit log.

Whether you use audit log for a rolling record of historical changes or to target alerts to sensitive events, the basics will be the same:

• event_target_type: Use this attribute for isolating certain types of events and sensitive changes. Check out the audit log glossary for a definition of events like 'Job Info Changed':

select * from audit_log where event_target_type = 'Job Info Changed'

• request_id: If you want to investigate an event further, use the event's request_id to find linked audit log entries containing event details:

select * from audit_log where request_id = 'bbe330197ea'

• event_meta: Audit log results sharing a common request_id may include event meta as before and after values or other important details about the event. Check out the example queries below.
• event_time: Use the linked entries and the corresponding event times to produce a timeline of events.
• performer_id: Examine which Greenhouse Recruiting user or integration performed the event.

Example queries

You can use attributes in API and columns in Business Intelligence Connector as query parameters, combined with the audit log glossary, to isolate impactful events in audit log.

select * from audit_log where event_target_type = 'Single Sign-On Changed'

select * from audit_log where request_id = '8df9ae5a17e522b8'

select * from audit_log where event_target_type = 'PII Page Accessed' and event_time between '2023-06-29 00:00:00.000' and '2023-06-30 23:59:00.0' and performer_id = '5407147002'

GET https://auditlog.us.greenhouse.io/events?event_target_types=Delete Candidate,Delete Application,Single Sign-On Changed

{
"results": [
        {
            "request": {
                "id": "8df9ae5a17e522b8",
                "type": "developer/sso/saml_configs#update"
            },
            "performer": {
                "meta": {
                    "name": "Katy Glaude",
                    "username": "katy.g@ymail.com"
                },
                "id": 5407147002,
                "ip_address": "123.123.123.123",
                "type": "user"
            },
            "organization_id": 4002999002,
            "event": {
                "meta": null,
                "target_type": "Single Sign-On Changed",
                "type": "action"
            },
            "event_time": "2023-07-21T18:21:23.607Z"
        }
    ]
}

Check out audit log use cases for more example queries.